Feature idea: calculate geo-distance in Logstash

[maximgue]

Rationale: prevent Elasticsearch from doing recurrent calculations by pre-calculating the distance from an IP location to a fixed location (e.g., your city or your servers' location) on Logstash level.

Example of possible config:

  distance { 
       from => "geoip"
       to => [ 48.8534100, 2.3488000 ] # or can be another field's name
       formula => "Haversine"
       unit => "meters"
       target => "DistanceToParisDatacenter"    
   }

Multiple "distance" directives could be present.

It might be part of the geoip filter, or can be a standalone filter.

Possible implementation: use https://github.com/kristianmandrup/geo-distance which does not require any external dependency (SQL DB etc.).

[ebuildy]

Could be another filter plugin, to run AFTER geoip filter (to have the GPS coord.).

Or a simple ruby filter using https://github.com/geokit/geokit:

ruby
{
    init => "require 'geokit'",
    code => "event['distance'] =  Geokit::LatLng.new(37.79363,-122.396116).distance_to(event[...], event[....])"
}